CVE-2026-120651

A flaw was found in perl-cgi. A remote attacker can trigger a denial of service DoS by sending an HTTP request containing a body shorter than its declared Content-Length header. When file upload processing is disabled, the server enters an infinite loop attempting to discard remaining data,...

CVE-2026-76506: Cisco Cisco Unified Computing System Central Software: A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated,…

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

PT-2026-137026

Name of the Vulnerable Software and Affected Versions Cisco UCS Central Software affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker to execute arbitrary commands, write arbitrary files to the filesystem, or disclose...

CVE-2026-110944: qt Qt Framework: Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.

Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server...

DEBIAN-CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

UBUNTU-CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-121441

A flaw was found in Wasmtime's wasi-http component. A malicious WebAssembly Wasm guest application can set multiple conflicting Content-Length headers on outgoing HTTP requests. This flaw allows an attacker to perform HTTP request smuggling through downstream servers or intermediaries that do not...

Security update for libsoup

This update for libsoup fixes the following issue: CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling bsc1283831. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

SUSE-SU-2026:5062-1 Security update for libsoup

This update for libsoup fixes the following issue: - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling bsc1283831...

CVE-2026-107441

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90AAHK.2C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...

EUVD-2026-115654

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90AAHK.2C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...

CVE-2026-107441

The Zyxel GS1900-24E switch is vulnerable to an out-of-bounds write (CWE-787) in the web-management CGI program (firmware through 2.90(AAHK.2)C0). The root cause involves the software storing request parameters in a fixed block and copying them before verifying the parameter count, allowing long ...

CVE-2026-107441

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90AAHK.2C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...

Joris Vink core numeric error vulnerability

Versions of Joris Vink prior to 4.3.0 contain a numeric error vulnerability. This vulnerability stems from an integer underflow in HTTP request body processing. Unauthenticated attackers can bypass httpbodymax by sending a request body exceeding its declared length, causing contentlength to wrap...

PT-2026-135851

Name of the Vulnerable Software and Affected Versions Zyxel GS1900-24E versions prior to 2.90 Patch 3 Description An out-of-bounds write issue exists in the CGI program of the device. An unauthenticated adjacent attacker can exploit this flaw via a crafted HTTP request to potentially execute OS...

CVE-2026-107441: Zyxel: An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0…

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90AAHK.2C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-150093)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150093 advisory. The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-150106)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150106 advisory. The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request...